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AMENDMENT S Tft THE CLAIMS 

Claim 1 (currently amended): A method for identifying a causal event among a plurality of 
events detected by a network management station on a network, which causal event is indicative 
of the underlying cause of more than one of said plurality of events, wherein certain of the events 
are related, w herein the network management station knows the topology of the network, the 
method performed by said network management station, and comprising the steps of: 

cowidoriag the location of the network device causing oooh far each related e vent in the 
plurality of event s - by, for e ach ev es*, determining the number of devices and/or links between 
network device causing The event and the nerwork management station, and 

determining as said causal event, the event for which the determined number of devices 
and/or links is the fewest. 



Claim 2 (cancelled). 

Claim 3 (previously presented): A method as claimed in claim 1, wherein the step of determining 
the number of devices and/or links between the device causing the event and the network 
management station comprises the steps of: detennining the shortest path between the device 
causing the event and the network management station using the topology of the nerwork and 
calculating the number of devices and/or links in the determined shortest path. 
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Claim 4 (previously presented): A method as claimed in claim 1, further comprising the step of: 
receiving each event, and automatically determining ihe number of devices and/or links between 
the device causing the event and the network management station. 

Claim 5 (original): A method as claimed in claim 4, further comprising storing the determined 
number of devices and/or links between the device causing the event and the network 
management station for each event. 

Claim 6 (previously presented): A method as claimed in claim 1, wherein the step of determining 
as said causal event comprises the step of: selecting as the causal event, the event for which the 
number of devices and/or links between the device causing the event and the network 
management station, is the fewest. 



Claim 7 (currently amended): A method as claimed in claim 1, whoroin prior to the stop of 
oonaidoring, the method eoropriooo the stop of: farther comprising d etermining if said plurality of 
events are related, and if it is determined that said plurality of events are related, storing said 
plurality of related events in an event list. 

Claim 8 (original): A method as claimed in claim 7, wherein the step of determining if the 
plurality of events are related comprises detennining the type of event for each of the plurality of 
events, and determining that said plurality of events are related if the events are of a similar type. 
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Claim 9 (original): A method as claimed in claim 7, wherein the method farmer comprises: 
receiving each event; and the step of determining if said plurality of events are related comprises 
the steps of: for each event, determining the time difference between the time of the received 
event and the time of the immediately preceding event, and determining that the received event is 
related to the immediately preceding event if the time difference is less than a predetermined 
time period. 

Claim 10 (original): A method as claimed in claim 9, wherein the ^determined time period is in 
the range 0 seconds to 5 minutes. 

Claim 1 1 (original): A method as claimed in claim 9, wherein, if the received event is determined 
to be related, the method further comprises the step of: storing the event in a list of related 
events, and if the received event is determined not to be related, the method further comprises the 
steps of: comparing the type of events in the existing list of related events, and selecting events 
of a similar, relevant type. 

Claim 12 (original): A method as claimed in claim 7, wherein the method further comprises: 
receiving each event; and the step of determining if said plurality of events are related comprises 
the steps of: for each event, comparing the type of the received event and The type of the 
immediately preceding event, and determining that the received event is related to the 
Mediately preceding event if the step of comparing finds me event type of the received event is 
similar to the event type of the immediately preceding event. 
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Claim 13 (original): A method as claimed in claim 7, wherein the method further comprises: 
receiving each event; and the step of determining if said plurality of events are related comprises 
the steps of: for each event, determining the rime difference between the time of the received 
event and the time of the immediately preceding event, and comparing the type of the received 
event and the type of the immediately preceding event, and deteroining that the received event is 
related to the immediately preceding event if the time difference is less than a predetermined 
time period and the events are similar in type. 

Claim 14 (original): A method as claimed in claim 13, wherein the predetermined time period is 
in the range of 0 seconds to 5 minutes. 

Claim 15 (original): A method as claimed in claim 7, further comprising the steps of, receiving 
each event; automatically determining if the event is related to the immediately preceding event, 
and if it is determined that the received event is related, storing the received event in the event 
list. 

Claim 16 (original): A method as claimed in claim 15, wherein, if it is determined mat the event 
is not related to the immediately preceding event, the method further comprises storing the 
received event in a new event list. 

Claim 17 (cancelled). 
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Claim 18 (original): A computer readable medium having a computer program for carrying out 
the method as claimed in claim 1. 

Claim 19 (previously presented): On a computer readable medium, a computer program for 
identifying a causal event among a plurality of events detected by a network management station 
on a network, which causal event is indicative of the underlying cause of more than one of said 
plurality of events, cmain of are related, and wherein the network 

management station knows the topology of the network, the computer program comprising: 

program means for uj uaidoring the lourticm of the netw o rk device con ni ng ooch ovont i n 
ui o plurality of ov mu , by, for ooc h (w e ^ eteroimng for each rented event . t he number of 
devices and/or links between d^- a network d evice causing the event and the network 

management station, and 

program means for determining as said causal event, the event for which the determined 

number of devices and/or links is the fewest. 

Claim 20 (previously presented): A network management apparatus for managing a network, 
comprising a network management station having a processor and memory, the memory storing 
data representing the topology of the network, wherein the network management station is 
configured to monitor the network and to generate events in finding predefined event conditions; 
wherein the network management station is further configured to identify a causal event among a 
plurality of related e vews generated by the network management station, which causal event is 
indicative of the underlying cause of more than one of said plurality of related events, by: 
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uM iul d u ii mi O m i n w i ri fw n f rtw mwafc davie* oauj J m oach w m r iu tho plurality o f 
wefttsrbyrfor each related event, determining the number of devices and/or links between **u 
nejwoj* device causing the event and the network management station, and 

detenniniug as said causal event, the event for which the determined number of devices 
and/or links is me fewest. 
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